CVE-2026-118462: AIS update mechanism executes unverified code

Published Nov 9, 2026

Updated

Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution.

Event History

Nov 9, 2026

CVE Published

via MITRE·11:51 AM

Data Sourced

via MITRE·11:51 AM

DescriptionWeakness

Data Sourced

via NVD·12:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Does exploitation require an authenticated account or user interaction?

No. The vector indicates no privileges are required and no user interaction is required, although exploitation has high attack complexity and requires an additional attack prerequisite.

Can this be exploited remotely?

Yes. The attack vector is network-based, so an attacker can target a reachable affected update mechanism without local access.

What is the potential impact of a successful exploit?

Successful exploitation can have high impact on the confidentiality, integrity, and availability of the vulnerable component. The supplied vector does not indicate impact on a separate subsequent system.

CVE-2026-118462: AIS update mechanism executes unverified code

Event History

Frequently Asked Questions

Does exploitation require an authenticated account or user interaction?

Can this be exploited remotely?

What is the potential impact of a successful exploit?

Company

Resources

Contact

Frequently Asked Questions

Does exploitation require an authenticated account or user interaction?

Can this be exploited remotely?

What is the potential impact of a successful exploit?